The WP construction now takes an invariant on states as a parameter
(part of the irisG class) and no longer builds in the authoritative
ownership of the entire state. When instantiating WP with a concrete
language on can choose its state invariant. For example, for heap_lang
we directly use `auth (gmap loc (frac * dec_agree val))`, and avoid
the indirection through invariants entirely.
As a result, we no longer have to carry `heap_ctx` around.

The old choice for ★ was a arbitrary: the precedence of the ASCII asterisk *
was fixed at a wrong level in Coq, so we had to pick another symbol. The ★ was
a random choice from a unicode chart.
The new symbol ∗ (as proposed by David Swasey) corresponds better to
conventional practise and matches the symbol we use on paper.

This is more consistent with CAS, which also can be used on any value.
Note that being able to (atomically) test for equality of any value and
being able to CAS on any value is not realistic. See the discussion at
https://gitlab.mpi-sws.org/FP/iris-coq/issues/26, and in particular JH
Jourdan's observation:
I think indeed for heap_lang this is just too complicated.
Anyway, the role of heap_lang is not to model any actual
programming language, but rather to show that we can do proofs
about certain programs. The fact that you can write unrealistic
programs is not a problem, IMHO. The only thing which is important
is that the program that we write are realistic (i.e., faithfully
represents the algorithm we want to p
This commit is based on a commit by Zhen Zhang who generalized equality
to work on any literal (and not just integers).

This commit features:
- A simpler model. The recursive domain equation no longer involves a triple
containing invariants, physical state and ghost state, but just ghost state.
Invariants and physical state are encoded using (higher-order) ghost state.
- (Primitive) view shifts are formalized in the logic and all properties about
it are proven in the logic instead of the model. Instead, the core logic
features only a notion of raw view shifts which internalizing performing frame
preserving updates.
- A better behaved notion of mask changing view shifts. In particular, we no
longer have side-conditions on transitivity of view shifts, and we have a
rule for introduction of mask changing view shifts |={E1,E2}=> P with
E2 ⊆ E1 which allows to postpone performing a view shift.
- The weakest precondition connective is formalized in the logic using Banach's
fixpoint. All properties about the connective are proven in the logic instead
of directly in the model.
- Adequacy is proven in the logic and uses a primitive form of adequacy for
uPred that only involves raw views shifts and laters.
Some remarks:
- I have removed binary view shifts. I did not see a way to describe all rules
of the new mask changing view shifts using those.
- There is no longer the need for the notion of "frame shifting assertions" and
these are thus removed. The rules for Hoare triples are thus also stated in
terms of primitive view shifts.
TODO:
- Maybe rename primitive view shift into something more sensible
- Figure out a way to deal with closed proofs (see the commented out stuff in
tests/heap_lang and tests/barrier_client).

This makes type checking more directed, and somewhat more predictable.
On the downside, it makes it impossible to declare the singleton on
lists as an instance of SingletonM and the insert and alter operations
on functions as instances of Alter and Insert. However, these were not
used often anyway.